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CLAIMS 

What is claimed is: 

1. A method for processing packets, the method comprising: 
identifying a packet; 

5 identifying a flow identification value based on the packet; and 

performing a lookup based on the flow identification value to identify a flow 
identification value mask. 

2. The method of claim 1, comprising masking the flow identification value with 
the flow identification value mask to generate a masked flow identification value. 

10 3. The method of claim 1 , comprising updating a data structure based on the 

masked flow identification value. 

4. The method of claim 1, wherein the flow identification value includes at least 
two items of the list consisting of source address, destination address, source port, 
destination port, and protocol type. 

15 5. The method of claim 1, wherein the flow identification value includes a 

transport layer, session layer, presentation layer or application layer value. 

6. The method of claim 1, wherein said performing the lookup based on the flow 
identification value includes performing a lookup operation in an access control list. 

7. The method of claim 1, wherein said performing the lookup based on the flow 
20 identification value includes: 

performing a first lookup operation on a first set of associative memory entries 
based on the flow identification value to generate an associative memory result; and 

performing a second lookup operation in an adjunct memory based on the 
associative memory result to identify the flow identification value mask. 
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8. The method of claim 7, wherein the first set of associative memory entries 
correspond to access control list entries. 

9. An apparatus for processing packets, the apparatus comprising: 

a packet processing engine configured to identify a packet and a flow 
5 identification value based on the packet; 

an associative memory configured to perform a first lookup operation based on 
the flow identification value to identifying a matching location; and 

an adjunct memory configured to perform a second lookup operation based on the 
matching location to identify a flow identification value mask. 

10 10. The apparatus of claim 9, comprising: 

masking logic configured to mask the flow identification value with the flow 
identification value mask to generate a masked flow identification value; and 

a value memory configured to update a value at a position corresponding to the 
masked flow identification value. 

15 1 1 . A computer-readable medium containing computer-executable instructions for 

performing steps for processing packets, said steps comprising: 
identifying a packet; 

identifying a flow identification value based on the packet; and 
performing a lookup based on the flow identification value to identify a flow 
20 identification value mask. 

12. The computer-readable medium of claim 11, wherein said steps comprise 
masking the flow identification value with the flow identification value mask to generate 
a masked flow identification value. 

13. The computer-readable medium of claim 11, wherein said steps comprise 
25 updating a data structure based on the masked flow identification value. 
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14. The computer-readable medium of claim 11, wherein the flow identification 
value includes at least two items of the list consisting of source address, destination 
address, source port, destination port, and protocol type. 

15. The computer-readable medium of claim 11, wherein the flow identification 
5 value includes a transport layer, session layer, presentation layer or application layer 

value. 

16. The computer-readable medium of claim 11, wherein said performing the 
lookup based on the flow identification value includes performing a lookup operation in 
an access control list. 

10 17. The computer-readable medium of claim 11, wherein said performing the 

lookup based on the flow includes: 

performing a first lookup operation on a first set of associative memory entries 
based on the flow identification value to generate an associative memory result; and 
performing a second lookup operation in an adjunct memory based on the 
15 associative memory result to identify the flow identification value mask. 

19. An apparatus for processing packets, the method comprising: 
means for identifying a packet; 

means for identifying a flow identification value based on the packet; and 
means for performing a lookup based on the flow identification value to identify a 
20 flow identification value mask. 

20. The apparatus of claim 19, comprising means for masking the flow 
identification value with the flow identification value mask to generate a masked flow 
identification value. 

21. The apparatus of claim 19, comprising means for updating a data structure 
25 based on the masked flow identification value. 
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22. The apparatus of claim 19, wherein the flow identification value includes at 
least two items of the list consisting of source address, destination address, source port, 
destination port, and protocol type. 

23. The apparatus of claim 19, wherein the flow identification value includes a 
transport layer, session layer, presentation layer or application layer value. 

24. The apparatus of claim 19, wherein said means for performing the lookup 
based on the flow identification value includes means for performing a lookup operation 
in an access control list. 

25. The apparatus of claim 19, wherein said means for performing the lookup 
based on the flow identification value includes: 

means for performing a first lookup operation on a first set of associative memory 
entries based on the flow identification value to generate an associative memory result; 
and 

means for performing a second lookup operation in an adjunct memory based on 
the associative memory result to identify the flow identification value mask. 
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